comparing values returned by two separate searches

[Justin_Grant]

I have two searches. One search returns a field (using stats count) representing the number of users logging into a website. The other search returns a field (also using stats count) representing the number of users who have tried to reset their password. If there are more password resets than normal logins, this usually indicates an attacker is trying to mine data from our password-reset function.

What I'd like is a search with a field representing the ratio of the two other counts.

Any idea how to do this efficiently?

[sideview]

The best way to do this is to use a disjunction and do it in a single search.

say that right now you have:

<login search> | stats count

<password reset search> | stats count

It somewhat depends on how complex the searches are but if they are literally just searches and they arent using other search commands, you can just do:

(<login search>) OR (<password reset search>)
| eval isLogin=if(searchmatch(<login search>),1,0) 
| eval isPasswordReset=if(searchmatch(<password reset search>),1,0) 
| stats sum(isLogin) as totalLogins sum(isPasswordReset) as totalPasswordResets

if you know that an event will never be both, then you could save some time by just doing totalPasswordResets = count-totalLogins, but you get the idea.

Its very common to approach these problems thinking about subsearches and thinking about the join and append commands, but often the best answer is just to use stats and eval. Here's another one: http://answers.splunk.com/questions/822/simulating-a-sql-join-in-splunk/1717#1717